CVE-2026-31848

Name of the Vulnerable Software and Affected Versions Nexxt Solutions Nebula 300+ versions prior to 12.01.01.38

Description Administrative authentication material is stored in the ecos pw cookie using a Base64-encoded format with a static suffix. Since Base64 is a reversible encoding scheme and the cookie lacks integrity protection, an attacker who obtains or derives this value can reconstruct or forge a valid administrative session to gain unauthorized access to the device.

Recommendations Update to a version newer than 12.01.01.37.